Mining Network Traffic Data

Transcription

1 Miig Network Traffic Data Ljiljaa Trajković Commuicatio Networks Laboratory School of Egieerig Sciece Simo Fraser Uiversity, Vacouver, British Columbia Caada Natioal Ceter for High-Performace Computig, Taia, Taiwa

2 Simo Fraser Uiversity, Buraby Campus Natioal Ceter for High-Performace Computig, Taia, Taiwa

3 Roadmap Itroductio Traffic collectio, characterizatio, ad modelig Case studies: telecommuicatio etwork: BCNET public safety wireless etwork: E-Comm satellite etwork: ChiaSat packet data etworks: Iteret Coclusios Natioal Ceter for High-Performace Computig, Taia, Taiwa

4 lhr: 535,102 odes ad 601,678 liks Natioal Ceter for High-Performace Computig, Taia, Taiwa

5 Roadmap Itroductio Traffic collectio, characterizatio, ad modelig Case studies: telecommuicatio etwork: BCNET public safety wireless etwork: E-Comm satellite etwork: ChiaSat packet data etworks: Iteret Coclusios Natioal Ceter for High-Performace Computig, Taia, Taiwa

6 Measuremets of etwork traffic Traffic measuremets: help uderstad characteristics of etwork traffic are basis for developig traffic models are used to evaluate performace of protocols ad applicatios Traffic aalysis: provides iformatio about the etwork usage helps uderstad the behavior of etwork users Traffic predictio: importat to assess future etwork capacity requiremets used to pla future etwork developmets Natioal Ceter for High-Performace Computig, Taia, Taiwa

7 Traffic modelig: self-similarity Self-similarity implies a fractal-like behavior Data o various time scales have similar patters Implicatios: o atural legth of bursts bursts exist across may time scales traffic does ot become smoother whe aggregated (ulike Poisso traffic) it is ulike Poisso traffic used to model traffic i telephoe etworks as the traffic volume icreases, the traffic becomes more bursty ad more self-similar Natioal Ceter for High-Performace Computig, Taia, Taiwa

8 Self-similarity Self-similarity implies a fractal-like behavior: data o various time scales have similar patters A wide-sese statioary process X() is called (exactly secod order) self-similar if its autocorrelatio fuctio satisfies: r (m) (k) = r(k), k 0, m = 1, 2,,, where m is the level of aggregatio Natioal Ceter for High-Performace Computig, Taia, Taiwa

9 Self-similar processes Properties: slowly decayig variace log-rage depedece Hurst parameter (H) Processes with oly short-rage depedece (Poisso): H = 0.5 Self-similar processes: 0.5 < H < 1.0 As the traffic volume icreases, the traffic becomes more bursty, more self-similar, ad the Hurst parameter icreases Natioal Ceter for High-Performace Computig, Taia, Taiwa

10 Self-similarity: ifluece of time-scales Geuie MPEG traffic trace E+06 5.E E+05 4.E+06 bits/time uit bits/time uit 6.E+05 4.E+05 bits/time uit 3.E+06 2.E E+05 1.E time uit = 160 ms (4 frames) 0.E time uit = 640 ms (16 frames) 0.E time uit = 2560 ms (64 frames) W. E. Lelad, M. S. Taqqu, W. Williger, ad D. V. Wilso, O the self-similar ature of Etheret traffic (exteded versio), IEEE/ACM Tras. Netw., vol. 2, o 1, pp. 1-15, Feb Natioal Ceter for High-Performace Computig, Taia, Taiwa

11 Self-similarity: ifluece of time-scales Sythetically geerated Poisso model E+06 5.E E+05 4.E+06 bits/time uit bits/time uit 6.E+05 4.E+05 bits/time uit 3.E+06 2.E E+05 1.E time uit = 160 ms (4 frames) 0.E time uit = 640 ms (16 frames) 0.E time uit = 2560 ms (64 frames) W. E. Lelad, M. S. Taqqu, W. Williger, ad D. V. Wilso, O the self-similar ature of Etheret traffic (exteded versio), IEEE/ACM Tras. Netw., vol. 2, o 1, pp. 1-15, Feb Natioal Ceter for High-Performace Computig, Taia, Taiwa

12 Roadmap Itroductio Traffic collectio, characterizatio, ad modelig Case studies: telecommuicatio etwork: BCNET public safety wireless etwork: E-Comm satellite etwork: ChiaSat packet data etworks: Iteret Coclusios Natioal Ceter for High-Performace Computig, Taia, Taiwa

13 Case study: BCNET packet capture BCNET is the hub of advaced telecommuicatio etwork i British Columbia, Caada that offers services to research ad higher educatio istitutios Natioal Ceter for High-Performace Computig, Taia, Taiwa

14 BCNET packet capture BCNET trasits have two service providers with 10 Gbps etwork liks ad oe service provider with 1 Gbps etwork lik Optical Test Access Poit (TAP) splits the sigal ito two distict paths The sigal splittig ratio from TAP may be modified The Data Capture Device (NijaBox 5000) collects the real-time data (packets) from the traffic filterig device Natioal Ceter for High-Performace Computig, Taia, Taiwa

15 Net Optics Director 7400: applicatio diagram Net Optics Director 7400 is used for BCNET traffic filterig It directs traffic to moitorig tools such as NijaBox 5000 ad FlowMo Natioal Ceter for High-Performace Computig, Taia, Taiwa

16 Network moitorig ad aalyzig: Edace card Edace Data Acquisitio ad Geeratio (DAG) 5.2X card resides iside the NijaBox 5000 It captures ad trasmits traffic ad has time-stampig capability DAG 5.2X is a sigle port Peripheral Compoet Itercoect Exteded (PCIx) card ad is capable of capturig o average Etheret traffic of 6.9 Gbps Natioal Ceter for High-Performace Computig, Taia, Taiwa

17 Real time etwork usage by BCNET members The BCNET etwork is high-speed fiber optic research etwork British Columbia's etwork exteds to 1,400 km ad coects Kamloops, Kelowa, Price George, Vacouver, ad Victoria Natioal Ceter for High-Performace Computig, Taia, Taiwa

18 Roadmap Itroductio Traffic collectio, characterizatio, ad modelig Case studies: telecommuicatio etwork: BCNET public safety wireless etwork: E-Comm satellite etwork: ChiaSat packet data etworks: Iteret Coclusios Natioal Ceter for High-Performace Computig, Taia, Taiwa

19 Case study: E-Comm etwork E-Comm etwork: a operatioal truked radio system servig as a regioal emergecy commuicatio system The E-Comm etwork is capable of both voice ad data trasmissios Voice traffic accouts for over 99% of etwork traffic A group call is a stadard call made i a truked radio system More tha 85% of calls are group calls A distributed evet log database records every evet occurrig i the etwork: call establishmet, chael assigmet, call drop, ad emergecy call Natioal Ceter for High-Performace Computig, Taia, Taiwa

20 E-Comm etwork Natioal Ceter for High-Performace Computig, Taia, Taiwa

21 E-Comm etwork architecture Users Trasmitters/Repeaters PSTN PBX Dispatch cosole * 8 # Vacouver I B M Network switch Other EDACS systems Buraby Database server Data gateway Maagemet cosole Natioal Ceter for High-Performace Computig, Taia, Taiwa

22 Traffic data 2001 data set: 2 days of traffic data to (110,348 calls) 2002 data set: 28 days of cotiuous traffic data to (1,916,943 calls) 2003 data set: 92 days of cotiuous traffic data to (8,756,930 calls) Natioal Ceter for High-Performace Computig, Taia, Taiwa

23 Observatios Presece of daily cycles: miimum utilizatio: ~ 2 PM maximum utilizatio: 9 PM to 3 AM 2002 sample data: cell 5 is the busiest others seldom reach their capacities 2003 sample data: several cells (2, 4, 7, ad 9) have all chaels occupied durig busy hours Natioal Ceter for High-Performace Computig, Taia, Taiwa

24 Call arrival rate i 2002 ad 2003: cyclic patters Number of calls Time (hours) 2002 Data 2003 Data the busiest hour is aroud midight the busiest day is Thursday Number of calls 12 x 104 Sat. Su. Mo. Tue. Wed. Thu. Fri. Time (days) useful for schedulig periodical maiteace tasks Data 2003 Data Natioal Ceter for High-Performace Computig, Taia, Taiwa

25 Modelig ad characterizatio of traffic We aalyzed voice traffic from a public safety wireless etwork i Vacouver, BC call iter-arrival ad call holdig times durig five busy hours from each year (2001, 2002, 2003) Statistical distributio ad the autocorrelatio fuctio of the traffic traces: Kolmogorov-Smirov goodess-of-fit test autocorrelatio fuctios wavelet-based estimatio of the Hurst parameter B. Vujičić, N. Cackov, S. Vujičić, ad Lj. Trajković, Modelig ad characterizatio of traffic i public safety wireless etworks, i Proc. SPECTS 2005, Philadelphia, PA, July 2005, pp Natioal Ceter for High-Performace Computig, Taia, Taiwa

26 Erlag traffic models Erlag B Erlag C N N A A N P N! B = P! N x C = N N A N 1 x N A A A N + x! x! N! N A x= 0 x= 0 P B : probability of rejectig a call P c : probability of delayig a call N : umber of chaels/lies A : total traffic volume Natioal Ceter for High-Performace Computig, Taia, Taiwa

27 Hourly traces Call holdig ad call iter-arrival times from the five busiest hours i each dataset (2001, 2002, ad 2003) Day/hour No. Day/hour No. Day/hour No :00 16: :00 01: :00 17: :00 20: :00 21:00 3,718 3,707 3,492 3,312 3, :00 05: :00 23: :00 24: :00 01: :00 01:00 4,436 4,314 4,179 3,971 3, :00 23: :00 24: :00 24: :00 03: :00 02:00 4,919 4,249 4,222 4,150 4,097 Natioal Ceter for High-Performace Computig, Taia, Taiwa

28 Statistical distributios Fourtee cadidate distributios: expoetial, Weibull, gamma, ormal, logormal, logistic, log-logistic, Nakagami, Rayleigh, Ricia, t-locatio scale, Birbaum-Sauders, extreme value, iverse Gaussia Parameters of the distributios: calculated by performig maximum likelihood estimatio Best fittig distributios are determied by: visual ispectio of the distributio of the trace ad the cadidate distributios Kolmogorov-Smirov test of potetial cadidates Natioal Ceter for High-Performace Computig, Taia, Taiwa

29 Call iter-arrival times: pdf cadidates Probability desity Traffic data Expoetial model Logormal model Weibull model Gamma model Rayleigh model Normal model Call iter-arrival time (s) Natioal Ceter for High-Performace Computig, Taia, Taiwa

30 Call iter-arrival times: K-S test results (2003 data) Distributio Expoetial Weibull Gamma Logormal Parameter , 22:00 23: , 23:00 24: , 23:00 24: , 02:00 03: , 01:00 02:00 h p k h p k h p k h p 1.015E E E E E-21 k Natioal Ceter for High-Performace Computig, Taia, Taiwa

31 Call iter-arrival times: estimates of H Traces pass the test for time costacy of a: estimates of H are reliable Day/hour H Day/hour H Day/hour H :00 16: :00 01: :00 17: :00 20: :00 21: :00 05: :00 23: :00 24: :00 01: :00 01: :00 23: :00 24: :00 24: :00 03: :00 02: Natioal Ceter for High-Performace Computig, Taia, Taiwa

32 Call holdig times: pdf cadidates Probability desity Traffic data Logormal model Gamma model Weibull model Expoetial model Normal model Rayleigh model Call holdig time (s) Natioal Ceter for High-Performace Computig, Taia, Taiwa

33 Call holdig times: estimates of H All (except oe) traces pass the test for costacy of a oly oe ureliable estimate (*): cosistet value Day/hour H Day/hour H Day/hour H :00 16: :00 05: :00 23: :00 01: :00 23: :00 24: :00 17: :00 24: :00 24: * :00 20: :00 01: :00 03: :00 21: :00 01: :00 02: Natioal Ceter for High-Performace Computig, Taia, Taiwa

34 Call iter-arrival ad call holdig times Day/hour Avg. (s) Day/hour Avg. (s) Day/hour Avg. (s) iter-arrival holdig 15:00 16: :00 05: :00 23: iter-arrival holdig 00:00 01: :00 23: :00 24: iter-arrival holdig 16:00 17: :00 24: :00 24: iter-arrival holdig 19:00 20: :00 01: :00 03: iter-arrival holdig 20:00 21: :00 01: :00 02: Avg. call iter-arrival times: 1.08 s (2001), 0.86 s (2002), 0.84 s (2003) Avg. call holdig times: 3.91 s (2001), 3.96 s (2002), 4.13 s (2003) Natioal Ceter for High-Performace Computig, Taia, Taiwa

35 Busy hour: best fittig distributios Distributio Busy hour Call iter-arrival times Call holdig times Weibull Gamma Logormal a b a b µ σ :00 16: :00 01: :00 17: :00 05: :00 23: :00 24: :00 23: :00 24: :00 24: Natioal Ceter for High-Performace Computig, Taia, Taiwa

36 Roadmap Itroductio Traffic collectio, characterizatio, ad modelig Case studies: telecommuicatio etwork: BCNET public safety wireless etwork: E-Comm satellite etwork: ChiaSat packet data etworks: Iteret Coclusios Natioal Ceter for High-Performace Computig, Taia, Taiwa

37 Case study: ChiaSat DirecPC system Natioal Ceter for High-Performace Computig, Taia, Taiwa

38 Network ad traffic data ChiaSat: etwork architecture ad TCP Aalysis of billig records: aggregated traffic user behavior Aalysis of tcpdump traces: geeral characteristics TCP optios ad operatig system (OS) figerpritig etwork aomalies Natioal Ceter for High-Performace Computig, Taia, Taiwa

39 Characteristics of satellite liks ChiaSat hybrid satellite etwork Employs geosychrous satellites deployed by Hughes Network Systems Ic. Provides data ad televisio services: DirecPC (Classic): uidirectioal satellite data service DirecTV: satellite televisio service DirecWay (Hughet): ew bi-directioal satellite data service that replaces DirecPC DirecPC trasmissio rates: 400 kb/s from satellite to user 33.6 kb/s from user to etwork operatios ceter (NOC) usig dial-up Improves performace usig TCP splittig with spoofig Natioal Ceter for High-Performace Computig, Taia, Taiwa

40 ChiaSat data: aalysis ChiaSat traffic is self-similar ad o-statioary Hurst parameter differs depedig o traffic load Modelig of TCP coectios: iter-arrival time is best modeled by the Weibull distributio umber of dowloaded bytes is best modeled by the logormal distributio The distributio of visited websites is best modeled by the discrete Gaussia expoetial (DGX) distributio Natioal Ceter for High-Performace Computig, Taia, Taiwa

41 ChiaSat data: aalysis Traffic predictio: autoregressive itegrative movig average (ARIMA) was successfully used to predict uploaded traffic (but ot dowloaded traffic) wavelet + autoregressive model outperforms the ARIMA model Q. Shao ad Lj. Trajkovic, Measuremet ad aalysis of traffic i a hybrid satellite-terrestrial etwork, Proc. SPECTS 2004, Sa Jose, CA, July 2004, pp Natioal Ceter for High-Performace Computig, Taia, Taiwa

42 Aalysis of collected data Aalysis of patters ad statistical properties of two sets of data from the ChiaSat DirecPC etwork: billig records tcpdump traces Billig records: daily ad weekly traffic patters user classificatio: sigle ad multi-variable k-meas clusterig based o average traffic hierarchical clusterig based o user activity Natioal Ceter for High-Performace Computig, Taia, Taiwa

43 Roadmap Itroductio Traffic collectio, characterizatio, ad modelig Case studies: telecommuicatio etwork: BCNET public safety wireless etwork: E-Comm satellite etwork: ChiaSat packet data etworks: Iteret Coclusios Natioal Ceter for High-Performace Computig, Taia, Taiwa

44 Iteret topology Iteret is a etwork of Autoomous Systems: groups of etworks sharig the same routig policy idetified with Autoomous System Numbers (ASN) Autoomous System Numbers: assigmets/as-umbers Iteret topology o AS-level: the arragemet of ASes ad their itercoectios Aalyzig the Iteret topology ad fidig properties of associated graphs rely o miig data ad capturig iformatio about Autoomous Systems (ASes) Natioal Ceter for High-Performace Computig, Taia, Taiwa

45 Variety of graphs Radom graphs: odes ad edges are geerated by a radom process Erdős ad Réyi model Small world graphs: odes ad edges are geerated so that most of the odes are coected by a small umber of odes i betwee Watts ad Strogatz model (1998) Natioal Ceter for High-Performace Computig, Taia, Taiwa

46 Scale-free graphs Scale-free graphs: graphs whose ode degree distributio follow power-law rich get richer Barabási ad Albert model (1999) Aalysis of complex etworks: discovery of spectral properties of graphs costructig matrices describig the etwork coectivity Natioal Ceter for High-Performace Computig, Taia, Taiwa 46

47 Aalyzed datasets Sample datasets: Route Views: TABLE_DUMP B / IGP : : : :3000 NAG RIPE: TABLE_DUMP B / IGP : :3010 NAG Natioal Ceter for High-Performace Computig, Taia, Taiwa 47

48 Iteret topology at AS level Datasets collected from Border Gateway Protocols (BGP) routig tables are used to ifer the Iteret topology at AS-level Natioal Ceter for High-Performace Computig, Taia, Taiwa 48

49 Iteret topology The Iteret topology is characterized by the presece of various power-laws: ode degree vs. ode rak eigevalues of the matrices describig Iteret graphs (adjacecy matrix ad ormalized Laplacia matrix) Power-laws expoets have ot sigificatly chaged over the years Spectral aalysis reveals ew historical treds ad otable chages i the coectivity ad clusterig of AS odes over the years Natioal Ceter for High-Performace Computig, Taia, Taiwa

50 Traffic aomalies Slammer, Nimda, ad Code Red I aomalies affected performace of the Iteret Border Gateway Protocol (BGP) BGP aomalies also iclude: Iteret Protocol (IP) prefix hijacks, miss-cofiguratios, ad electrical failures Techiques for detectig BGP aomalies have recetly gaied visible attetio ad importace Natioal Ceter for High-Performace Computig, Taia, Taiwa

51 Aomaly detectio techiques Classificatio problem: assigig a aomaly or regular label to a data poit Accuracy of a classifier depeds o: extracted features combiatio of selected features uderlyig model Goal: Detect Iteret routig aomalies usig the Border Gateway Protocol (BGP) update messages Natioal Ceter for High-Performace Computig, Taia, Taiwa

52 BGP features Approach: Defie a set of 37 features based o BGP update messages Extract the features from available BGP update messages that are collected durig the time period whe the Iteret experieced aomalies: Slammer Nimda Code Red I Natioal Ceter for High-Performace Computig, Taia, Taiwa

53 Feature selectio Select the most relevat features for classificatio usig: Fisher Miimum Redudacy Maximum Relevace (mrmr) Odds Ratio Decisio Tree Fuzzy Rough Sets Natioal Ceter for High-Performace Computig, Taia, Taiwa

54 Aomaly classificatio Trai classifiers for BGP aomaly detectio usig: Support Vector Machies Hidde Markov Models Naive Bayes Decisio Tree Extreme Learig Machie (ELM) Natioal Ceter for High-Performace Computig, Taia, Taiwa

55 Feature extractio: BGP messages Border Gateway Protocol (BGP) eables exchage of routig iformatio betwee gateway routers usig update messages BGP update message collectios: Réseaux IP Europées (RIPE) uder the Routig Iformatio Service (RIS) project Route Views Available i multi-threaded routig toolkit (MRT) biary format Natioal Ceter for High-Performace Computig, Taia, Taiwa

56 BGP: kow aomalies Aomaly Date Duratio (h) Slammer Jauary 25, Nimda September 18, Code Red I July 19, Traiig Data Dataset Slammer + Nimda Dataset 1 Slammer + Code Red I Dataset 2 Code Red I + Nimda Dataset 3 Slammer Dataset 4 Nimda Dataset 5 Code Red I Dataset 6 Natioal Ceter for High-Performace Computig, Taia, Taiwa

57 Slammer worm Seds its replica to radomly geerated IP addresses Destiatio IP address gets ifected if: or it is a Microsoft SQL server a persoal computer with the Microsoft SQL Server Data Egie (MSDE) Natioal Ceter for High-Performace Computig, Taia, Taiwa

58 Nimda worm Propagates through messages, web browsers, ad file systems Viewig the message triggers the worm payload The worm modifies the cotet of the web documet files i the ifected hosts ad copies itself i all local host directories Natioal Ceter for High-Performace Computig, Taia, Taiwa

59 Code Red I worm Takes advatage of vulerability i the Microsoft Iteret Iformatio Services (IIS) idexig software It triggers a buffer overflow i the ifected hosts by writig to the buffers without checkig their limit Natioal Ceter for High-Performace Computig, Taia, Taiwa

60 Feature extractio: BGP messages Defie 37 features Sample every miute durig a five-day period: the peak day of a aomaly two days prior ad two days after the peak day 7,200 samples for each aomalous evet: 5,760 regular samples (o-aomalous) 1,440 aomalous samples Imbalaced dataset Natioal Ceter for High-Performace Computig, Taia, Taiwa

61 BGP features Feature Defiitio Category 1 Number of aoucemets Volume 2 Number of withdrawals Volume 3 Number of aouced NLRI prefixes Volume 4 Number of withdraw NLRI prefixes Volume 5 Average AS-PATH legth AS-path 6 Maximum AS-PATH legth AS-path 7 Average uique AS-PATH legth AS-path 8 Number of duplicate aoucemets Volume 9 Number of duplicate withdrawals Volume 10 Number of implicit withdrawals Volume Natioal Ceter for High-Performace Computig, Taia, Taiwa

62 BGP features Feature Defiitio Category 11 Average edit distace AS-path 12 Maximum edit distace AS-path 13 Iter-arrival time Maximum edit distace =, where = (7,..., 17) Maximum AS-path legth =, where = (7,..., 15) Volume AS-path AS-path 34 Number of IGP packets Volume 35 Number of EGP packets Volume 36 Number of icomplete packets Volume 37 Packet size (B) Volume Natioal Ceter for High-Performace Computig, Taia, Taiwa

63 Feature selectio algorithms Employed to select the most relevat features: Fisher Miimum Redudacy Maximum Relevace (mrmr) Odds Ratio Decisio Tree Fuzzy Rough Sets Natioal Ceter for High-Performace Computig, Taia, Taiwa

64 Feature selectio: decisio tree Dataset Traiig data Selected Features Dataset 1 Slammer + Nimda 1 21, 23 29, Dataset 2 Slammer + Code Red I 1 22, 24 29, Dataset 3 Code Red I + Nimda 1 29, Either four (30, 31, 32, 33) or five (22, 30, 31, 32, 33) features are removed i the costructed trees maily because: features are umerical ad some are used repeatedly Natioal Ceter for High-Performace Computig, Taia, Taiwa

65 Feature selectio: fuzzy rough sets Dataset Traiig data Selected Features Dataset 4 Slammer 1, 3 6, 9, 10, 13 32, 35 Dataset 5 Nimda 1, 3 4, 8 10, 12, 14 32, 35, 36 Dataset 6 Code Red I 3 4, 8 10, 12, 14 32, 35, 36 Usig combiatio of datasets, for example Slammer + Nimda for traiig leads to higher computatioal load Each dataset was used idividually Natioal Ceter for High-Performace Computig, Taia, Taiwa

66 Aomaly classificatio Trai classifiers for BGP aomaly detectio usig: Support Vector Machies Hidde Markov Models Naive Bayes Decisio Tree Extreme Learig Machie (ELM) Natioal Ceter for High-Performace Computig, Taia, Taiwa

67 Aomaly classifiers: decisio tree Dataset Testig data Acc trai Acc test Traiig time (s) Dataset 1 Code Red I Dataset 2 Nimda Dataset 3 Slammer Each path from the root ode to a leaf ode may be trasformed ito a decisio rule A set of rules that are obtaied from a traied decisio tree may be used for classifyig usee samples Natioal Ceter for High-Performace Computig, Taia, Taiwa

68 Aomaly classifiers: ELM No. of features Dataset Acc trai Acc Traiig time test (s) Dataset ± ± Dataset ± ± Dataset ± ± Dataset ± ± Dataset ± ± Dataset ± ± hidde uits The biary features are removed to form a set of 17 features Natioal Ceter for High-Performace Computig, Taia, Taiwa

69 Aomaly classifiers: ELM No. of features Dataset Acc trai Acc test 28 Dataset ± ± (from 37) Dataset ± ± Dataset ± ± Dataset ± ± (from 17) Dataset ± ± Dataset ± ± Natioal Ceter for High-Performace Computig, Taia, Taiwa

70 Roadmap Itroductio Traffic collectio, characterizatio, ad modelig Case studies: telecommuicatio etwork: BCNET public safety wireless etwork: E-Comm satellite etwork: ChiaSat packet data etworks: Iteret Coclusios Natioal Ceter for High-Performace Computig, Taia, Taiwa

71 Coclusios Data collected from deployed etworks are used to: evaluate etwork performace characterize ad model traffic (iter-arrival ad call holdig times) idetify treds i the evolutio of the Iteret topology classify traffic ad etwork aomalies Natioal Ceter for High-Performace Computig, Taia, Taiwa

72 Refereces: sources of data RIPE RIS raw data [Olie]. Available: Uiversity of Orego Route Views project [Olie]. Available: CAIDA: Ceter for Applied Iteret Data Aalysis: [Olie]. Available: Natioal Ceter for High-Performace Computig, Taia, Taiwa

73 Refereces: M. Cosovic, S. Obradovic, ad Lj. Trajković, Performace evaluatio of BGP aomaly classifiers, i Proc. The Third Iteratioal Coferece o Digital Iformatio, Networkig, ad Wireless Commuicatios, DINWC 2015, Moscow, Russia, Feb. 2015, pp Y. Li, H. J. Xig, Q. Hua, X.-Z. Wag, P. Batta, S. Haeri, ad Lj. Trajković, Classificatio of BGP aomalies usig decisio trees ad fuzzy rough sets," to be preseted at IEEE Iteratioal Coferece o Systems, Ma, ad Cyberetics, SMC 2014, Sa Diego, CA, October N. Al-Rousa, S. Haeri, ad Lj. Trajković, Feature selectio for classificatio of BGP aomalies usig Bayesia models," i Proc. Iteratioal Coferece o Machie Learig ad Cyberetics, ICMLC 2012, Xi'a, Chia, July 2012, pp N. Al-Rousa ad Lj. Trajković, Machie learig models for classificatio of BGP aomalies, i Proc. IEEE Cof. High Performace Switchig ad Routig, HPSR 2012, Belgrade, Serbia, Jue 2012, pp T. Farah, S. Lally, R. Gill, N. Al-Rousa, R. Paul, D. Xu, ad Lj. Trajković, Collectio of BCNET BGP traffic," i Proc. 23rd ITC, Sa Fracisco, CA, USA, Sept. 2011, pp S. Lally, T. Farah, R. Gill, R. Paul, N. Al-Rousa, ad Lj. Trajković, Collectio ad characterizatio of BCNET BGP traffic," i Proc IEEE Pacific Rim Cof. Commuicatios, Computers ad Sigal Processig, Victoria, BC, Caada, Aug. 2011, pp Natioal Ceter for High-Performace Computig, Taia, Taiwa

74 lhr: 535,102 odes ad 601,678 liks Natioal Ceter for High-Performace Computig, Taia, Taiwa